Under the npm model you are trusting the authors of your direct dependencies with judicious choice of transitive dependencies, and then those authors in turn tr

Under the npm model you are trusting the authors of your direct dependencies with judicious choice of transitive dependencies, and then those authors in turn trust the authors of their dependencies. In essence npm is a system that relies on a web of trust. A system like that cannot give any modicum of control, because typically a real world project will involve hundreds of package publishers, any one of which can break that trust with a poisoned patch version of a transitive dependency (or can be hacked), and it is effectively impossible to review all those dependencies every time they do a patch version bump. So developing with npm is always an act of faith that everyone will do the right thing. The remarkable part is how rarely it breaks down.